# US 2018/0121654 A1 · Systems and methods for malware evasion management

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2018/0121654 A1
- Document ID: US20180121654A1
- Status: Published application
- Kind: A1
- Application number: 15/844,762
- Filed: 2017-12-18
- Published: 2018-05-03
- Earliest claimed: 2015-03-05
- Assignees: Minerva Labs Ltd.
- Applicants: Minerva Labs Ltd.
- Inventors: Eduard BOBRITSKY; Erez BREIMAN; Omri MOYAL
- Web page: https://patentgrep.com/patent/US20180121654A1

## CPC

- G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities}
- G06F 16/245: Query processing
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A method for emulating at least one resource in a host computer to a querying hosted code. The method comprises monitoring a plurality of operating system (OS) queries received from a plurality of code executed on a monitored computing unit, the plurality of OS queries are designated to an OS of the monitored computing unit, detecting among the plurality of OS queries at least one query for receiving at least one characteristic of at least one resource of the monitored computing unit among the plurality of OS queries, the at least one query is received from querying code of the plurality of code, preparing a response of the OS to the at least one query, the response comprising a false indication at least one false characteristic of the at least one resource, and sending the response to the querying code in response to the at least one query.

## Claims

### Claim 1

A method for emulating at least one resource in a host computer to a querying hosted code, comprising:
monitoring a plurality of operating system (OS) queries received from a plurality of code executed on a monitored computing unit, said plurality of OS queries are designated to an OS of said monitored computing unit;
detecting among said plurality of OS queries at least one query for receiving at least one characteristic of at least one resource of said monitored computing unit among said plurality of OS queries, said at least one query is received from querying code of said plurality of code;
preparing a response of said OS to said at least one query, said response comprising a false indication at least one false characteristic of said at least one resource; and
sending said response to said querying code in response to said at least one query.

### Claim 2 (depends on 1)

The method of claim 1, wherein said false indication is of an execution of a security mechanism for processing running programs by said monitored computing unit, said false indication is sent while said monitored computing unit does not execute said security mechanism.

### Claim 3 (depends on 1)

The method of claim 1, wherein said false indication is of an absence of execution of a security mechanism for processing running programs on said monitored computing unit, said false indication is sent while said monitored computing unit executes said security mechanism.

### Claim 4 (depends on 1)

The method of claim 1, wherein said at least one query comprises a query for accessing at least part of sensitive data managed by said OS of said monitored computing unit; wherein said false indication comprises an indication of a false copy of said at least part of said sensitive data.

### Claim 5 (depends on 1)

The method of claim 1, wherein said plurality of OS queries comprises a plurality of OS Application Program Interface (API) service requests selected to invoke said OS to perform a task at runtime.

### Claim 6 (depends on 1)

The method of claim 1, wherein said monitoring comprises hooking said plurality of OS queries before said OS receives said plurality of OS queries.

### Claim 7 (depends on 1)

The method of claim 1, further comprising hooking a true response by said OS to said OS query before said querying code receives said true response.

### Claim 8 (depends on 1)

The method of claim 1, wherein said plurality of OS queries comprises a member of a group consisting of a function call, an event and a message.

### Claim 9 (depends on 1)

The method of claim 1, further comprising classifying said querying code as a malicious code and blocking at least one function of said querying code from being executed by said monitored computing unit.

### Claim 10 (depends on 1)

The method of claim 1, further comprising detecting at least one action performed by said querying code after receiving said response and classifying said querying code according to said at least one action.

### Claim 11 (depends on 10)

The method of claim 10, wherein said detecting comprises matching said at least one action to a predefined model and classifying said querying code according to said match.

### Claim 12 (depends on 1)

The method of claim 1, further comprising counting the number of processor instructions that arise from said response and classifying said querying code according to said counting.

### Claim 13 (depends on 1)

The method of claim 1, further comprising accessing and analyzing the executable instructions of the querying code stored within a local memory of said monitored computing.

### Claim 14 (depends on 1)

The method of claim 1, wherein said response is a preconfigured response emulating a response of a computing unit running a SandBox environment for executing said querying code.

### Claim 15 (depends on 1)

The method of claim 1, wherein said response is a preconfigured response emulating a response of a computing unit of without an actual resource managed by said monitored computing unit.

### Claim 16 (depends on 1)

The method of claim 1, further comprising managing a general response policy defining a plurality of local response policies each for another of a plurality of monitored computing units including said monitored computing unit; wherein said preparing comprises preparing said response according to response instructions defined in a respective said local response policy.

### Claim 17 (depends on 16)

The method of claim 16, further comprising in response to said detecting at least one query, managing said general response policy by dynamically correlating between at least some of said plurality of local response policies at run time, wherein said local response policy for each one of a plurality of monitored computing units is correlated based on said general response policy.

### Claim 18 (depends on 1)

The method of claim 1, further comprising:
forwarding said querying code to run in a testing environment;
detecting at least one additional query for receiving said at least one characteristic among said plurality of operating system (OS) queries from said querying code;
preparing an additional response of said OS to said at least one additional query for provoking said querying code to escalate a malicious attack, said additional response comprises another false indication of an absence of execution of a security mechanism for processing running programs on said monitored computing unit, said false indication is sent while said testing environment executes said security mechanism;
sending said additional response to said querying code in response to said at least one additional query; and
monitoring said querying code for detecting said malicious attack.

### Claim 19 (depends on 1)

The method of claim 1, further comprising calculating a score for said querying code and managing operations of said querying code according to said score.

### Claim 20 (depends on 1)

A computer readable medium comprising computer executable instructions adapted to perform the method of claim 1.